Question

A financial services company runs sensitive workloads on Compute Engine VMs. During a security review, auditors require assurance that each VM boots only trusted, verified firmware and OS components, and that any tampering with the boot integrity (such as kernel-level rootkits or bootkits) can be detected and monitored. The architect must configure the VMs to meet this requirement with minimal custom tooling. What should the architect implement?

Accepted Answer

Enable Shielded VM features (Secure Boot, vTPM, and integrity monitoring) on the instances and review integrity monitoring results in Cloud Monitoring.

Answer

Deploy Confidential VMs using AMD SEV to encrypt memory in use and rely on that to detect boot-level tampering.

Answer

Install a third-party host-based intrusion detection agent on each VM and forward alerts to Cloud Logging.

Answer

Enable OS Login with two-factor authentication and restrict SSH access via IAM to prevent unauthorized boot changes.